US8037515B2 - Methods and apparatus for providing application credentials - Google Patents

Methods and apparatus for providing application credentials Download PDF

Info

Publication number
US8037515B2
US8037515B2 US10/697,397 US69739703A US8037515B2 US 8037515 B2 US8037515 B2 US 8037515B2 US 69739703 A US69739703 A US 69739703A US 8037515 B2 US8037515 B2 US 8037515B2
Authority
US
United States
Prior art keywords
credential
application
server
data
request
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US10/697,397
Other versions
US20050097330A1 (en
Inventor
Laurence Lundblade
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Qualcomm Inc
Original Assignee
Qualcomm Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Qualcomm Inc filed Critical Qualcomm Inc
Priority to US10/697,397 priority Critical patent/US8037515B2/en
Assigned to QUALCOMM INCORPORATED reassignment QUALCOMM INCORPORATED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: LUNDBLADE, LAURENCE
Publication of US20050097330A1 publication Critical patent/US20050097330A1/en
Application granted granted Critical
Publication of US8037515B2 publication Critical patent/US8037515B2/en
Application status is Active legal-status Critical
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/33User authentication using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0815Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network providing single-sign-on or federations
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • H04L63/126Applying verification of the received information the source of the received data

Abstract

Methods and apparatus for providing an application credential for an application running on a device. In one embodiment, a method provides an application credential to an application running on a device, wherein the application credential is used by the application to authenticate to a data server. The method comprises receiving a request to generate the application credential, wherein the request includes an application identifier. The method also comprises generating the application credential using the application identifier and a master credential associated with the device.

Description

BACKGROUND

I. Field

The present invention relates generally to credential systems, and more particularly, to methods and apparatus for providing application credentials to applications running on a device for the purpose of authentication and security.

II. Description of the Related Art

Advances in technology have resulted in the development and deployment of extensive data networks. These networks include both public data networks, such as the Internet, and specialized networks, such as wireless telecommunication networks. Users of these networks have the ability to access a wide variety of information and services that are available as network resources.

One example where there is an increasing demand for network resources is in wireless network environments. In wireless environments, a variety of wireless devices, such as wireless telephones, personal digital assistants (PDAs), and paging devices, communicate over a wireless network. The wireless network may also include network servers that operate to provide various network resources to the wireless devices. Furthermore, the wireless networks may also be coupled to a public network, such as the Internet, so that resources on the public network can be made available to the wireless devices on the wireless network.

Typically, a wireless device may download an application program from a wireless network. The application may be downloaded for free or purchased by the user of the wireless device, who effectively obtains the rights to use the application or content for an unlimited, fixed, or usage count based expiration period. During execution, the application may attempt to retrieve proprietary data from a data server. For example, the application may be a news retrieval application, and during operation, the application requests news data from a proprietary news data server. Before transmitting the data, the data server needs to verify that the application is authorized to receive the data. It is therefore necessary for the application to authenticate to the data server.

However, strong authentication is not possible unless there is a secret shared between the device and the server that is different for every device. If that is not the case, reverse engineering of the application will reveal enough information to gain access to the server. The shared secret should be distributed out of band, and not over the network connection between the device and the server. One approach is to provision a separate key into every device at the time of manufacture or sale. This is how some systems operate to authenticate voice calls. However, this technique does not scale to large numbers of applications, doesn't work for applications that are downloaded after purchase of the device, and application vendors may not have access to the manufacturing or sales process.

Another technique is to issue separate passwords to the each device user where the passwords are distributed using voice mail, email, paper mail, or some other out of band means. This may provide a partial solution, however, this techniques results in more user responsibility, more overhead for the application or content developer, and the requirement to create, distribute, and maintain passwords for every application used by every user.

Therefore, what is needed is a system to provide application credentials that can be used by applications running on a device to authenticate their requests for data from proprietary data servers, where the application credentials provide strong authentication without the need to have multiple passwords for every device.

SUMMARY

In one or more embodiments, a credential system is described that provides credentials to applications running on a device. In one embodiment, an application running on a device provides an application identifier in a request for credentials that is sent to the credential system. The credential system uses the application identifier and a master credential to generate an application credential for use by the application. After obtaining the application credential, the application sends a request for data to a data server, and the request includes the application credential and the application identifier. The data server receives the request and includes the application identifier in a request for a server credential, which is sent to a credential server. The credential server has a copy of the master credential. The credential server uses the application identifier and the master credential to generate the server credential, which is transmitted back to the data server. The data server then compares the application credential with the server credential, and if they match, the server sends the requested data to the application. Thus, it is possible for the application to authenticate to the data server without the use of special passwords.

In another embodiment, the data server transmits the application identifier and the application credential to the credential server in a request for credential verification. The credential server generates a server credential using the application identifier and the master credential. The credential server compares the application credential with the server credential and determines whether or not the two credentials match. If the credentials match, the credential server transmits a positive indicator to the data server, thereby authorizing the data server to transmit the requested data to the application.

In one embodiment, a method provides an application credential to an application running on a device, wherein the application credential is used by the application to authenticate to a data server. The method comprises receiving a request to generate the application credential, wherein the request includes an application identifier. The method also comprises generating the application credential using the application identifier and a master credential associated with the device.

In another embodiment, apparatus is provided that operates to provide an application credential to an application running on the device, wherein the application credential is used by the application to authenticate to a data server. The apparatus comprises receiving logic that operates to receive a request for the application credential, wherein the request includes an application identifier. The apparatus also comprises generating logic that operates to generate the application credential using the application identifier and a master credential.

In another embodiment, apparatus is provided that operates to provide an application credential to an application running on the device, wherein the application credential is used by the application to authenticate to a data server. The apparatus comprises means for receiving a request for the application credential, wherein the request includes an application identifier. The apparatus also comprises means for generating the application credential using the application identifier and a master credential.

In another embodiment, a computer-readable media is provided comprising instructions, which when executed by a processor in a device, provide an application credential to an application running on the device, wherein the application credential is used by the application to authenticate to a data server. The computer readable media comprises instructions for receiving a request for the application credential, wherein the request includes an application identifier. The computer-readable media also comprises instructions for generating the application credential using the application identifier and a master credential.

In another embodiment, a method is provided for operating a credential server to authenticate an application running on a device, wherein the application transmits a request for data to a data server and the request comprises an application credential. The method comprises receiving an application identifier in a request for a server credential, and generating the server credential using the application identifier and a master credential. The method also comprises transmitting the server credential to the data server, wherein if the server credential and the application credential match the application is authenticated.

Other aspects, advantages, and features of the present invention will become apparent after review of the hereinafter set forth Brief Description of the Drawings, Detailed Description of the Invention, and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing aspects and the attendant advantages of the embodiments described herein will become more readily apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings wherein:

FIG. 1 shows a data network that comprises one embodiment of a credential system that provides application credentials to applications running on a wireless device;

FIG. 2 shows a functional block diagram illustrating one embodiment of the wireless device of FIG. 1 that includes one embodiment of a credential system that operates to provide application credentials to applications running on the device;

FIG. 3 shows one embodiment of a method for operating a credential system to provide application credentials to an application running on a device;

FIG. 4 shows a functional block diagram of a data server that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device;

FIG. 5 shows one embodiment of a method for operating a data server in a credential system to authenticate an application credential provided by an application running on a device;

FIG. 6 shows a functional block diagram of another embodiment of a data server that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device;

FIG. 7 shows one embodiment of a credential server that operates in a credential system to authenticate an application credential provided to an application running on a device;

FIG. 8 shows one embodiment of a method for operating a credential server in a credential system to authenticate an application credential provided by an application running on a device; and

FIG. 9 shows a functional block diagram of another embodiment of a credential server that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device.

DETAILED DESCRIPTION

The following detailed description describes a credential system that provides credentials to an application running on a device. The device may be any type of computing device such as a desktop computer, server, or other type of computer. The system is also well suited for use with portable devices such as, tablet computers, PDAs, wireless telephones, email devices, pagers or any other type of portable device. Therefore, although the system is suitable for use with a wide variety of devices, for the purpose of clarity, embodiments of the invention are described herein with reference to a wireless device.

The device includes a copy of a master credential that was installed in the device during manufacture, or by using some other secure procedure that protects the master credential from public disclosure. The master credential is also known to a credential server.

In one or more embodiments, the credential system interacts with a runtime environment executing on the device that is used to simplify operation of the device, such as by providing generalized calls for device specific resources. One such runtime environment is the Binary Runtime Environment for Wireless™ (BREW™) software platform developed by QUALCOMM, Inc., of San Diego, Calif. In the following description, it will be assumed that the device is executing a runtime environment, such as the BREW software platform. However, one or more embodiments of the credential system are suitable for use with other types of runtime environments to provide application credentials to applications running on a variety of wired and wireless devices.

FIG. 1 shows a data network 100 that comprises one embodiment of a credential system that provides application credentials to applications running on a device. The network 100 comprises a wireless device 102 that communicates with a data network 104 via a wireless communication channel 106. The network 100 may be any type of data network and comprise both wired and wireless components. The network 100 also comprises a credential server 108 that operates to provide services to the wireless device 102 and other entities in communication with the network 104. For example, the wireless device 102 may be a wireless telephone, and the credential server 108 may be part of a nationwide telecommunications network that provides telecommunication services to the device 102. Also in communication with the network 104 is a data server 110. The data server 110 operates to provide data, such as multimedia content or other types of data, to devices that are in communication with the wireless network 104.

In one embodiment, the device 102 includes a master credential 114 that was installed in the device during manufacture or by using some other secure procedure. The master credential 114 may be any type of suitable credential that is not made public to allow the device 102 to authenticate to other entities, such as the credential server 108. The device 102 also comprises credential generation logic 116. The credential generation logic 116 generates a credential based on specific input information. In one embodiment, the logic 116 uses a “one-way” generation technique so that the generated credential cannot be decoded or reversed to determine the input information that was used to generate the credential. For example, the logic 116 may use a hash function to generate the credential.

During operation, the credential system operates to provide application credentials to an applications running on the device 102 by performing one or more of the following steps.

  • 1. An application program 118 running on the device 102 requests an application credential from the credential system. The application includes an application identifier (ID) in the request for the application credential. The request for the application credential is shown at 128.
  • 2. The credential system uses the application ID and the Master Credential 114 to generate the application credential for the application 118. The application credential is returned to the application 118 as shown at 130.
  • 3. The application 118 sends the application credential, and optionally the ID, to the data server 110 with a request to obtain data. The request to obtain data is shown at 120.
  • 4. The data server 110 sends the ID to the credential server 108 in a request for a server credential. The request for the server credential is shown at 122.
  • 5. The credential server 108 uses the ID and the Master Credential 114 to generate a server credential using the credential generating logic 116 that is located at the credential server 108. The resulting server credential is returned to the data server 110 as shown at 124.
  • 6. The data server 110 compares the application credential with the server credential, and if the two match, the application's request 120 for data is authenticated and the data server 110 transmits the requested data, as shown at 126.

Therefore, because the application credentials can vary for each user, the system operates to authenticate both the user and the application.

FIG. 2 shows a functional block diagram 200 illustrating one embodiment of the device 102 that includes one embodiment of a credential system that provides application credentials to applications running on the device 102.

The device 102 comprises an application/ID signature checker 202, credential generation logic 206, a master credential 204, an application 210, an application ID 212, and a digital signature 214. The master credential 204 is stored in a secure non-volatile memory or other secure logic so that it is protected from erasure and unauthorized disclosure. The signature 214 was created by some application signing service or authority and binds the application 210 with the application ID 212. In one or more embodiments, any type of modification detection technique can be used in place of the signature 214.

The application/ID signature checker 202 detects if information encoded with the digital signature has been modified. It also allows the handset to know in a strong way that the application is truly the one assigned the particular application ID. For example, by providing the application 210, the ID 212, and the signature 214 to the checker 202, the checker 202 can determine if the application 210 and/or the ID 212 have been changed or modified after the digital signature was created. In one or more embodiments, the checker 202 operates with any type of modification detection technique.

The credential generation logic 206 generates a credential based on information received at its input. The generation logic 206 uses a “one-way” technique to generate the credential so that the credential cannot be decoded or reversed to determine the information used to create it.

During operation of one embodiment, the application 210 has an associated application ID 212 and a signature 214. The signature 214 binds the application 210 and the ID 212. The signature may have been generated by the application developer, or by a third party that is different from the application developer. The application 210 operates to retrieve data from a data server, for example, the data server 110 in FIG. 1. However, in order to retrieve the data, the application 210 needs to obtain an application credential to authenticate to the data server. The following method describes how in one embodiment, the credential system provides an application credential to the application 210, so that the application 210 can authenticate to a data server, for example, the server 110.

FIG. 3 shows one embodiment of a method 300 for operating a credential system to provide application credentials to an application running on a device. For example, the method 300 will be described with reference to the device 102 shown in FIG. 2. It will be assumed that the application 210 is running on the device 102 and that the application 210 requires an application credential to authenticate to a data server to retrieve data.

At block 302, the device operates to determine whether the application 210 and/or its ID 212 have been modified or incorrectly associated. In one embodiment, the application 210, the ID 212, and the signature 214 are sent to the checker 202, as shown by path 224. The checker 202 operates to use any known technique to verify that the application 210 and/or the ID 212 have not been modified.

At block 304, the application requests an application credential from the credential system so that the application can authenticate to a data server to retrieve data. In one embodiment, the application's ID 212 is provided to the credential generation logic 206, as shown by path 216 in a request for an application credential. Note that the application's ID 212 is provided after being checked so that an application can not provide an arbitrary ID in order to get credentials for other applications.

At block 306, an application credential is generated for the application. In one embodiment, the generation logic 206 generates the application credential 208 using the application ID 212, and the master credential 204. For example, in one embodiment, the generation logic 206 uses a hash function to generate the application credential 208, so that the application credential 208 cannot be decoded or reversed to discover the master credential 204. The application credential 208 is then returned to the application 210 as shown by path 218. Because the application credential 208 is generated using a “one-way” technique, the master credential 204 is never at risk of being discovered or disclosed.

At block 308, the application credential is used by the application to authenticate to a data server to retrieve data for use on the device. For example, the application 210 transmits the credential 208 in a request for data to the data server, as shown by path 220. The request may also include the application's ID 212. For example, the request is transmitted to the data server 110 in FIG. 1. The data server 110 may already have access to the application's ID, and so it may not be necessary for the device to transmit the ID to the data server.

At block 310, assuming the application's data request is authenticated; the requested data is transmitted to the application 210 from the data server, as shown by path 222. For example, the data server 110 receives the request from the application 210 and operates to authenticate the application before transmitting the requested data. A more detailed description of the authentication process performed by the data server is provided in another section of this document.

The method 300 is intended to be illustrative and not limiting of the operation of the various embodiments described herein. For example, it would be obvious to one with skill in the art to make minor changes, additions or deletions to any of the described methods. Furthermore, the described method steps may be combined, rearranged or reordered without deviating from the scope of the described embodiments.

FIG. 4 shows a functional block diagram 400 of the data server 110 that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device. For example, the server 110 receives a request for data from the application 210 and the request includes the application credential 208 and the application ID 212. After the server 110 authenticates the request, it provides the requested data to the application 210. The server 110 comprises a content server 404, content/data 406, credential and matching logic 402.

In one embodiment, the credential matching logic 414 operates to receive the application credential and the server credential and compare them. The result of the comparison 418 is sent to the content server 404. Usually the result 418 will be approval when the credentials are equal in value. The essential difference between the application credential 208 and the server credential 414 is that former was generated on the end user device and the later on the server.

It should be noted that the configuration of the server 110 is just one configuration suitable for implementing one embodiment of the credential system. It is also possible to implement the credential system using other servers or server configurations within the scope of the present invention.

FIG. 5 shows one embodiment of a method 500 for operating a data server in a credential system to authenticate an application credential provided by an application running on a device. For example, the method 500 will be described with reference to the server 110 shown in FIG. 4. It will be assumed that the application 210 is running on the device 102, and that the application 210 obtains the application credential 208 from the credential system. The application 210 submits the application credential 208 and the application ID 212 in a request for data to the data server 110.

At block 502, the data server receives a request for data from an application running on a device. The request for data comprises the application credential 208 and the application ID 212.

At block 504, the data server requests a server credential from a credential server. For example, the application ID 212 and an authentication token 408 are sent (shown by 410 and 412) to the credential server in a request for a server credential. For example, the request is transmitted to the credential server 108.

At block 506, the server credential is received from the credential server. For example, the credential server 108 generates a server credential 414 using the application ID 212 and a copy of the master credential 204 stored at the credential server 108. The server credential 414 is generated using the same credential generation technique that was used to generate the application credential 208.

At block 508, a test is performed to determine if the server credential 414 matches the application credential 208, thereby authenticating the application 210 as the data requestor. For example, the matching logic 402 matches the two credentials using any type of matching technique. If the two credentials match, a positive indicator is provided at the matching output 418. As a result, the application's 210 data request is authenticated and the content server 404 operates to transmit content/data 406 to the application 210 to satisfy the application's data request. If the two credentials do not match, a negative indicator is provided at the match output 418 and the content server 404 does not provide any data in response to the data request.

The method 500 is intended to be illustrative and not limiting of the operation of the various embodiments described herein. For example, it would be obvious to one with skill in the art to make minor changes, additions or deletions to any of the described methods. Furthermore, the described method steps may be combined, rearranged or reordered without deviating from the scope of the described embodiments.

FIG. 6 shows a functional block diagram 600 of another embodiment of the data server 110 that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device. In the embodiment shown in FIG. 6, the server 110 includes a credential forwarder 602 that forwards the ID 212, the authentication token 408, and the application credential 208 (shown at 410, 412, and 604) to the credential server. The credential server generates a server credential and compares the server credential with the application credential 208. If the application credential and the server credential match, the credential server transmits an authorization 606 to the data server 110. The authorization is forwarded (via path 418) to the content server 404, which then operates to transmit the content/data 406 to the requesting application 210. Thus, in the embodiment shown in FIG. 6, the credential server operates to compare the application credential to the server credential, where in the embodiment of FIG. 4, the data server 110 performs this comparison.

FIG. 7 shows one embodiment of the credential server 108 that operates in a credential system to authenticate an application credential provided to an application running on a device. The credential server 108 comprises verification logic 702, the master credential 204 and the credential generation logic 706.

FIG. 8 shows one embodiment of a method 800 for operating a credential server in a credential system to authenticate an application credential provided by an application running on a device. For example, the method 800 will be described with reference to the credential server 108 shown in FIG. 7. It will be assumed that the data server 110 has sent a request to the credential server 108 to obtain a server credential that can be matched to the application credential 208. The request for the server credential received by the credential server 108 includes the application ID 212 and the authentication token 408.

At block 802, the credential server 108 receives the request from the data server to obtain a server credential. For example, the data server 110 transmits a request to the credential server 108 to obtain a server credential, and the request includes the application ID 212 and the authentication token 408.

At block 804, the credential server 108 uses the authentication token 408 to authenticate the request at the verification logic 702. This authentication is used to be sure the request being made for a given application ID 212 from a data server that is allowed to access server credentials 414 belonging to the application indicated by the application ID 212.

At block 806, after the request has been verified, the credential generation logic 706 uses the application ID 212 and the master credential 204 to generate the server credential 414. The credential generation 706 logic in most embodiments will be functionally the same as the logic 206 on the end device 102.

At block 808, the credential server transmits the server credential 414 to the data server (as shown by path 704) so that the data server may use the server credential to authenticate a data request from an application running on a device.

The method 800 is intended to be illustrative and not limiting of the operation of the various embodiments described herein. For example, it would be obvious to one with skill in the art to make minor changes, additions or deletions to any of the described methods. Furthermore, the described method steps may be combined, rearranged or reordered without deviating from the scope of the described embodiments.

FIG. 9 shows a functional block diagram 900 of another embodiment of the credential server 108 that includes one embodiment of a credential system that authenticates a request for data received from an application running on a device. In the embodiment shown in FIG. 9, the server 108 receives the application credential 208 and includes credential-matching logic 902.

During operation, the credential generation logic 706 generates the server credential 414, which is then compared to the application credential 208 at the credential matching logic 902. If the application credential 208 and the server credential 414 match, the credential server transmits the authorization 606 to the data server 110. Thus, in the embodiment shown in FIG. 9, the credential server 108 operates to compare the application credential 208 to the server credential 414, where in the embodiment of FIG. 7, the data server 110 performs this comparison.

Implementations

The above-described systems comprise interconnected functional elements that may be embodied in a variety of implementations. For example, any of the described elements may comprise a CPU, processor, gate array, hardware logic, memory, software, or any combination of hardware and software. Each system further comprises logic to execute machine-readable instructions to perform the functions described herein.

In one or more embodiments, the machine readable instructions are stored on computer-readable media that interfaces to any of the described systems, so that the instructions may be downloaded into the systems for execution to perform the described functions. The computer-readable media comprises floppy disks, hard disks, Flash memory, RAM, ROM, CDROM or any other type of computer-readable media that may contain instructions for execution by the systems described herein.

A credential system has been described that includes methods and apparatus to provide credentials to applications running on a device. The system is suitable for use with all types of devices and is especially well suited for use with wireless devices, such as mobile telephones, to provide application credentials to applications that need to authenticate to data servers or other systems.

Accordingly, while one or more embodiments of methods and apparatus for a credential system have been illustrated and described herein, it will be appreciated that various changes can be made to the embodiments without departing from their spirit or essential characteristics. Therefore, the disclosures and descriptions herein are intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.

Claims (23)

1. A method for operating a credential server to authenticate an application running on a device, wherein the application transmits a request for data to a data server and the request comprises an application credential, the method comprising:
receiving an application identifier in a request for a server credential;
generating the server credential using the application identifier and a master credential, wherein the master credential allows the device to be authenticated to other entities; and
transmitting the server credential to the data server, wherein if the server credential and the application credential match, the application is authenticated.
2. The method of claim 1, further comprising receiving an authentication token that proves the request is associated with the application identifier.
3. The method of claim 1, further comprising:
receiving the application credential;
matching the application credential and the server credential; and
transmitting an authorization to the data server to fulfill the data request if the application credential matches the server credential.
4. The method of claim 1, wherein the generating comprises generating the server credential using a one-way generation technique, so that the application identifier and the master credential cannot be discovered from the server credential.
5. The method of claim 1, wherein the application requesting the server credential is one of a plurality of applications running at the device, and the application identifier identifies only the application requesting the server credential.
6. Apparatus for use with a credential server to authenticate an application running on a device, wherein the application transmits a request for data to a data server and the request comprises an application credential, the apparatus comprising:
first receiving logic that operates to receive an application identifier in a request for a server credential;
generating logic that operates to generate the server credential based on the application identifier and a master credential, wherein the master credential allows the device to be authenticated to other entities; and
transmitting logic that operates to transmit the server credential to the data server, wherein the data server matches the server credential to the application credential to authenticate the application.
7. The apparatus of claim 6, further comprising second receiving logic that operates to receive an authentication token that proves the request is associated with the application identifier.
8. The apparatus of claim 6, wherein the generating logic comprises logic to generate the server credential using a one-way generation technique, so that the application identifier and the master credential cannot be discovered from the server credential.
9. The apparatus of claim 6, further comprising:
second receiving logic that operates to receive the application credential; and
matching logic that operates to match the application credential with the server credential, and transmit an authorization to fulfill the data request to the data server if the application credential matches the server credential.
10. Apparatus for use with a credential server to authenticate an application running on a device, wherein the application transmits a request for data to a data server and the request comprises an application credential, the apparatus comprising:
means for receiving an application identifier in a request for a server credential;
means for generating the server credential based on the application identifier and a master credential, wherein the master credential allows the device to be authenticated to other entities; and
means for transmitting the server credential to the data server, wherein the data server matches the server credential to the application credential to authenticate the application.
11. The apparatus of claim 10, wherein the means for receiving further receives an authentication token that proves the request is associated with the application identifier.
12. The apparatus of claim 10, wherein the means for generating comprises means for generating the server credential using a one-way generation technique, so that the application identifier and the master credential cannot be discovered from the server credential.
13. The apparatus of claim 10, further comprising:
means for receiving the application credential; and
means for matching the application credential with the server credential; and
means for transmitting an authorization to fulfill the data request to the data server if the application credential matches the server credential.
14. A non-transitory computer-readable media comprising instructions, which when executed by a processor in a credential server, operate to authenticate an application running on a device, wherein the application transmits a request for data to a data server and the request comprises an application credential, the computer-readable media comprising:
instructions for receiving an application identifier in a request for a server credential;
instructions for generating the server credential based on the application identifier and a master credential, wherein the master credential allows the device to be authenticated to other entities; and
instructions for transmitting the server credential to the data server, wherein the data server matches the server credential to the application credential to authenticate the application.
15. The non-transitory computer-readable media of claim 14, further comprising receiving an authentication token that proves the request is associated with the application identifier.
16. The non-transitory computer-readable media of claim 14, wherein the instructions for generating comprises instructions for generating the server credential using a one-way generation technique, so that the application identifier and the master credential cannot be discovered from the server credential.
17. The non-transitory computer-readable media of claim 14, further comprising:
instructions for receiving the application credential;
instructions for matching the application credential with the server credential; and
instructions for transmitting an authorization to fulfill the data request to the data server if the application credential matches the server credential.
18. A method for processing an application credential associated with an application running on a device, wherein the application credential is used by the application to authenticate to a data server, the method comprising:
receiving a request to generate the application credential, wherein the request includes an application identifier;
generating the application credential using the application identifier and a master credential, wherein the master credential allows the device to be authenticated to other entities;
transmitting a request for data to a data server, wherein the request comprises the application credential;
requesting a server credential from a credential server, wherein the request for the server credential comprises the application identifier and a token by which the data server authenticates itself;
generating the server credential using the application identifier and the master credential;
transmitting the server credential to the data server;
matching the server credential with the application credential, wherein the application is authenticated if the two credentials match; and
transmitting the data to the application.
19. The method of claim 18, wherein the application credential and the server credential are generated using a one-way generation technique, so that the application identifier and the master credential cannot be discovered.
20. The method of claim 18, further comprising using a modification detection and authentication technique to determine if the application identifier has been modified and prove the application is associated with the application identifier.
21. The method of claim 20, wherein the modification detection and authentication technique is a digital signature.
22. The method of claim 18, further comprising receiving an authentication token at the credential server that proves the request is associated with the application identifier.
23. The method of claim 18, wherein the device is a wireless device.
US10/697,397 2003-10-29 2003-10-29 Methods and apparatus for providing application credentials Active 2026-07-07 US8037515B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10/697,397 US8037515B2 (en) 2003-10-29 2003-10-29 Methods and apparatus for providing application credentials

Applications Claiming Priority (18)

Application Number Priority Date Filing Date Title
US10/697,397 US8037515B2 (en) 2003-10-29 2003-10-29 Methods and apparatus for providing application credentials
EP04796868.0A EP1680884B1 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
MXPA06004676A MXPA06004676A (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials.
CN200480032049.XA CN1875564B (en) 2003-10-29 2004-10-28 A method and apparatus for providing application credentials
RU2006118331/09A RU2322763C2 (en) 2003-10-29 2004-10-28 Methods and device for providing authentication data of applications
CA 2543987 CA2543987A1 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
BRPI0415916 BRPI0415916A (en) 2003-10-29 2004-10-28 method and apparatus for providing application credentials
KR20067010496A KR100863204B1 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
PE0010382004A PE08542005A1 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
JP2006538396A JP4616268B2 (en) 2003-10-29 2004-10-28 Method and apparatus for providing an application credential
AU2004285255A AU2004285255C1 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
PCT/US2004/036284 WO2005043334A2 (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
NZ54671704A NZ546717A (en) 2003-10-29 2004-10-28 Methods and apparatus for providing application credentials
TW093133007A TW200517971A (en) 2003-10-29 2004-10-29 Methods and apparatus for providing application credentials
ARP040103991 AR050394A1 (en) 2003-10-29 2004-10-29 Methods and apparatus for providing application credentials
IL17499906A IL174999D0 (en) 2003-10-29 2006-04-11 Methods and apparatus for providing application credentials
US13/270,771 US8424068B2 (en) 2003-10-29 2011-10-11 Methods and apparatus for providing application credentials
US13/863,368 US8856905B2 (en) 2003-10-29 2013-04-15 Methods and apparatus for providing application credentials

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/270,771 Continuation US8424068B2 (en) 2003-10-29 2011-10-11 Methods and apparatus for providing application credentials

Publications (2)

Publication Number Publication Date
US20050097330A1 US20050097330A1 (en) 2005-05-05
US8037515B2 true US8037515B2 (en) 2011-10-11

Family

ID=34550352

Family Applications (3)

Application Number Title Priority Date Filing Date
US10/697,397 Active 2026-07-07 US8037515B2 (en) 2003-10-29 2003-10-29 Methods and apparatus for providing application credentials
US13/270,771 Active US8424068B2 (en) 2003-10-29 2011-10-11 Methods and apparatus for providing application credentials
US13/863,368 Active US8856905B2 (en) 2003-10-29 2013-04-15 Methods and apparatus for providing application credentials

Family Applications After (2)

Application Number Title Priority Date Filing Date
US13/270,771 Active US8424068B2 (en) 2003-10-29 2011-10-11 Methods and apparatus for providing application credentials
US13/863,368 Active US8856905B2 (en) 2003-10-29 2013-04-15 Methods and apparatus for providing application credentials

Country Status (16)

Country Link
US (3) US8037515B2 (en)
EP (1) EP1680884B1 (en)
JP (1) JP4616268B2 (en)
KR (1) KR100863204B1 (en)
CN (1) CN1875564B (en)
AR (1) AR050394A1 (en)
AU (1) AU2004285255C1 (en)
BR (1) BRPI0415916A (en)
CA (1) CA2543987A1 (en)
IL (1) IL174999D0 (en)
MX (1) MXPA06004676A (en)
NZ (1) NZ546717A (en)
PE (1) PE08542005A1 (en)
RU (1) RU2322763C2 (en)
TW (1) TW200517971A (en)
WO (1) WO2005043334A2 (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130036456A1 (en) * 2010-04-08 2013-02-07 Securekey Technologies Inc. Credential provision and proof system
US8424068B2 (en) 2003-10-29 2013-04-16 Qualcomm Incorporated Methods and apparatus for providing application credentials
US20130182838A1 (en) * 2012-01-13 2013-07-18 Qualcomm Incorporated Method and apparatus for generating a privilege-based key
US8682297B2 (en) 2011-10-11 2014-03-25 Tangome, Inc. Seamlessly authenticating device users
US20140331299A1 (en) * 2007-11-15 2014-11-06 Salesforce.Com, Inc. Managing Access to an On-Demand Service

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4361894B2 (en) * 2005-09-15 2009-11-11 株式会社エヌ・ティ・ティ・ドコモ External memory management apparatus and external memory management method
US20070204167A1 (en) * 2006-02-28 2007-08-30 Aladdin Knowledge Systems Ltd. Method for serving a plurality of applications by a security token
US8522025B2 (en) * 2006-03-28 2013-08-27 Nokia Corporation Authenticating an application
KR100879808B1 (en) * 2006-12-11 2009-01-22 소프트캠프(주) Approching control system to the file server
EP2353269A1 (en) 2008-11-07 2011-08-10 Mobile TAG Method for accessing a plurality of services by a mobile terminal user, and related secure device
US8505078B2 (en) * 2008-12-28 2013-08-06 Qualcomm Incorporated Apparatus and methods for providing authorized device access
US8468585B2 (en) * 2009-01-05 2013-06-18 International Business Machines Corporation Management of credentials used by software applications
US8424070B1 (en) * 2009-11-05 2013-04-16 Sprint Communications Company L.P. Dynamic network-centric generation of public service access identification
GB2487533A (en) * 2011-01-21 2012-08-01 Lionel Wolovitz Access control with application specific rules and access requests including application identifiers
KR101253341B1 (en) * 2011-02-08 2013-04-10 (주)바이너리소프트 System and method for verifying counterfeit or falsification of application for mobile
US8327006B2 (en) 2011-02-24 2012-12-04 Jibe Mobile Endpoint device and article of manufacture for application to application communication over a network
EP2691925A4 (en) * 2011-03-31 2014-08-20 Google Inc Integrated mobile/server applications
US9032492B2 (en) 2011-09-01 2015-05-12 Microsoft Corporation Distributed computer systems with time-dependent credentials
US9058467B2 (en) 2011-09-01 2015-06-16 Microsoft Corporation Distributed computer systems with time-dependent credentials
US8640210B2 (en) 2011-09-01 2014-01-28 Microsoft Corporation Distributed computer systems with time-dependent credentials
DE102012201431A1 (en) * 2012-02-01 2013-08-01 Robert Bosch Gmbh System and method for licensing a plurality of software components
CA2818439A1 (en) 2012-07-05 2014-01-05 Cyber-Ark Software Ltd. System and method for out-of-band application authentication
JP6066647B2 (en) 2012-09-27 2017-01-25 キヤノン株式会社 Device device, a control method, and program
US8850543B2 (en) 2012-12-23 2014-09-30 Mcafee, Inc. Hardware-based device authentication
US9088555B2 (en) * 2012-12-27 2015-07-21 International Business Machines Corporation Method and apparatus for server-side authentication and authorization for mobile clients without client-side application modification
US10148626B2 (en) 2014-12-10 2018-12-04 Pacific Dolphin Holdings Llc Systems and methods for facilitating mobile transactions
US9910997B1 (en) * 2014-12-23 2018-03-06 Google Llc Secure credential storage
US9887990B2 (en) 2016-04-25 2018-02-06 International Business Machines Corporation Protection of application passwords using a secure proxy

Citations (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5560008A (en) * 1989-05-15 1996-09-24 International Business Machines Corporation Remote authentication and authorization in a distributed data processing system
WO1998045768A1 (en) 1997-04-10 1998-10-15 Nortel Networks Corporation Method and system for networked installation of uniquely customized, authenticable, and traceable software applications
WO1999007007A2 (en) 1997-07-29 1999-02-11 Catharon Productions, Inc. Computerized system and associated method for optimally controlling storage and transfer of computer programs on a computer network
WO1999052077A1 (en) 1998-03-31 1999-10-14 Sony Computer Entertainment Inc. Image drawing device, image drawing method, and providing medium
US5987232A (en) * 1995-09-08 1999-11-16 Cadix Inc. Verification server for use in authentication on networks
WO2000035143A1 (en) 1998-12-04 2000-06-15 Virtual Business Associates Pt Message identification with confidentiality, integrity, and source authentication
RU2169437C1 (en) 1998-12-29 2001-06-20 Свисском Мобиле Аг Procedure to gain access to objects for users of telecommunication network
US6272631B1 (en) * 1997-06-30 2001-08-07 Microsoft Corporation Protected storage of core data secrets
WO2002008873A1 (en) 2000-07-25 2002-01-31 Macrovision Coporation System and method of verifying the authenticity of dynamically connectable executable images
US20020023059A1 (en) * 2000-01-14 2002-02-21 Bari Jonathan H. Method and system for secure registration, storage, management and linkage of personal authentication credentials data over a network
WO2002019598A2 (en) 2000-08-28 2002-03-07 Contentguard Holdings, Inc. Systems and methods for integrity certification and verification of content consumption environments
US6477645B1 (en) * 1999-02-03 2002-11-05 Intel Corporation Authority and integrity check in systems lacking a public key
US20030037237A1 (en) * 2001-04-09 2003-02-20 Jean-Paul Abgrall Systems and methods for computer device authentication
US20030074392A1 (en) 2001-03-22 2003-04-17 Campbell Yogin Eon Methods for a request-response protocol between a client system and an application server
US20030114144A1 (en) 2001-11-26 2003-06-19 Atsushi Minemura Application authentication system
US6668327B1 (en) * 1999-06-14 2003-12-23 Sun Microsystems, Inc. Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system
US20040049588A1 (en) * 2002-09-05 2004-03-11 Hitachi, Ltd. Access management server, method thereof, and program recording medium
US6785262B1 (en) 1999-09-28 2004-08-31 Qualcomm, Incorporated Method and apparatus for voice latency reduction in a voice-over-data wireless communication system
US20040180646A1 (en) * 2003-03-10 2004-09-16 Donley Christopher J. Authentication mechanism for telephony devices
US20050071677A1 (en) * 2003-09-30 2005-03-31 Rahul Khanna Method to authenticate clients and hosts to provide secure network boot
WO2005043335A2 (en) 2003-10-29 2005-05-12 Qualcomm Incorporated System for invoking a privileged function in a device
WO2005043336A2 (en) 2003-10-29 2005-05-12 Qualcomm Incorporated System for dynamic registration of privileged mode hooks in a device
US7010690B1 (en) * 2000-07-07 2006-03-07 Sun Microsystems, Inc. Extensible system for building and evaluating credentials
US7047560B2 (en) 2001-06-28 2006-05-16 Microsoft Corporation Credential authentication for mobile users
US7146635B2 (en) * 2000-12-27 2006-12-05 International Business Machines Corporation Apparatus and method for using a directory service for authentication and authorization to access resources outside of the directory service
US7210167B2 (en) 2001-01-08 2007-04-24 Microsoft Corporation Credential management
US7752434B2 (en) * 2001-09-21 2010-07-06 Corel Corporation System and method for secure communication

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001117823A (en) * 1999-10-15 2001-04-27 Fuji Xerox Co Ltd Data storage device with access qualification authenticating function
US8037515B2 (en) 2003-10-29 2011-10-11 Qualcomm Incorporated Methods and apparatus for providing application credentials

Patent Citations (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5560008A (en) * 1989-05-15 1996-09-24 International Business Machines Corporation Remote authentication and authorization in a distributed data processing system
US5987232A (en) * 1995-09-08 1999-11-16 Cadix Inc. Verification server for use in authentication on networks
WO1998045768A1 (en) 1997-04-10 1998-10-15 Nortel Networks Corporation Method and system for networked installation of uniquely customized, authenticable, and traceable software applications
US6272631B1 (en) * 1997-06-30 2001-08-07 Microsoft Corporation Protected storage of core data secrets
WO1999007007A2 (en) 1997-07-29 1999-02-11 Catharon Productions, Inc. Computerized system and associated method for optimally controlling storage and transfer of computer programs on a computer network
WO1999052077A1 (en) 1998-03-31 1999-10-14 Sony Computer Entertainment Inc. Image drawing device, image drawing method, and providing medium
WO2000035143A1 (en) 1998-12-04 2000-06-15 Virtual Business Associates Pt Message identification with confidentiality, integrity, and source authentication
RU2169437C1 (en) 1998-12-29 2001-06-20 Свисском Мобиле Аг Procedure to gain access to objects for users of telecommunication network
US6477645B1 (en) * 1999-02-03 2002-11-05 Intel Corporation Authority and integrity check in systems lacking a public key
US6668327B1 (en) * 1999-06-14 2003-12-23 Sun Microsystems, Inc. Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system
US6785262B1 (en) 1999-09-28 2004-08-31 Qualcomm, Incorporated Method and apparatus for voice latency reduction in a voice-over-data wireless communication system
US20020023059A1 (en) * 2000-01-14 2002-02-21 Bari Jonathan H. Method and system for secure registration, storage, management and linkage of personal authentication credentials data over a network
US7010690B1 (en) * 2000-07-07 2006-03-07 Sun Microsystems, Inc. Extensible system for building and evaluating credentials
WO2002008873A1 (en) 2000-07-25 2002-01-31 Macrovision Coporation System and method of verifying the authenticity of dynamically connectable executable images
WO2002019598A2 (en) 2000-08-28 2002-03-07 Contentguard Holdings, Inc. Systems and methods for integrity certification and verification of content consumption environments
US7146635B2 (en) * 2000-12-27 2006-12-05 International Business Machines Corporation Apparatus and method for using a directory service for authentication and authorization to access resources outside of the directory service
US7210167B2 (en) 2001-01-08 2007-04-24 Microsoft Corporation Credential management
US20030074392A1 (en) 2001-03-22 2003-04-17 Campbell Yogin Eon Methods for a request-response protocol between a client system and an application server
US20030037237A1 (en) * 2001-04-09 2003-02-20 Jean-Paul Abgrall Systems and methods for computer device authentication
US7047560B2 (en) 2001-06-28 2006-05-16 Microsoft Corporation Credential authentication for mobile users
US7752434B2 (en) * 2001-09-21 2010-07-06 Corel Corporation System and method for secure communication
US20030114144A1 (en) 2001-11-26 2003-06-19 Atsushi Minemura Application authentication system
US20040049588A1 (en) * 2002-09-05 2004-03-11 Hitachi, Ltd. Access management server, method thereof, and program recording medium
US20040180646A1 (en) * 2003-03-10 2004-09-16 Donley Christopher J. Authentication mechanism for telephony devices
US20050071677A1 (en) * 2003-09-30 2005-03-31 Rahul Khanna Method to authenticate clients and hosts to provide secure network boot
WO2005043336A2 (en) 2003-10-29 2005-05-12 Qualcomm Incorporated System for dynamic registration of privileged mode hooks in a device
WO2005043335A2 (en) 2003-10-29 2005-05-12 Qualcomm Incorporated System for invoking a privileged function in a device

Non-Patent Citations (10)

* Cited by examiner, † Cited by third party
Title
3GPP TSG SA WG3 Security S3#26, "Architecture to support subscriber certificates based on new 'gateway' type element," Nov 19-22, 2002, S3-020634.
European Search Report-EP04796868, Search Authority-Munich Patent Office, Jun. 18, 2010.
European Search Report—EP04796868, Search Authority—Munich Patent Office, Jun. 18, 2010.
International Preliminary Report on Patentability, PCT/US2004/036284-International Preliminary Examining Authority-US, Mar. 16, 2006.
International Preliminary Report on Patentability, PCT/US2004/036284—International Preliminary Examining Authority—US, Mar. 16, 2006.
International Search Report, PCT/US2004/036284-International Search Authority-US, Nov. 3, 2005.
International Search Report, PCT/US2004/036284—International Search Authority—US, Nov. 3, 2005.
Menezes, A. et al.: Handbook of Applied Cryptography, Chapter 9, Hash Functions and Data Integrity, CRC Press (1999).
Written Opinion, PCT/US2004/036284-International Search Authority-US, Nov. 3, 2005.
Written Opinion, PCT/US2004/036284—International Search Authority—US, Nov. 3, 2005.

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8424068B2 (en) 2003-10-29 2013-04-16 Qualcomm Incorporated Methods and apparatus for providing application credentials
US8856905B2 (en) 2003-10-29 2014-10-07 Qualcomm Incorporated Methods and apparatus for providing application credentials
US20150304305A1 (en) * 2007-11-15 2015-10-22 Salesforce.Com, Inc. Managing access to an on-demand service
US9667622B2 (en) * 2007-11-15 2017-05-30 Salesforce.Com, Inc. Managing access to an on-demand service
US20140331299A1 (en) * 2007-11-15 2014-11-06 Salesforce.Com, Inc. Managing Access to an On-Demand Service
US9565182B2 (en) * 2007-11-15 2017-02-07 Salesforce.Com, Inc. Managing access to an on-demand service
US20130036456A1 (en) * 2010-04-08 2013-02-07 Securekey Technologies Inc. Credential provision and proof system
US10210489B2 (en) * 2010-04-08 2019-02-19 Securekey Technologies Inc. Credential provision and proof system
US8682297B2 (en) 2011-10-11 2014-03-25 Tangome, Inc. Seamlessly authenticating device users
US20130182838A1 (en) * 2012-01-13 2013-07-18 Qualcomm Incorporated Method and apparatus for generating a privilege-based key
US10135613B2 (en) * 2012-01-13 2018-11-20 Qualcomm Incorporated Method and apparatus for generating a privilege-based key

Also Published As

Publication number Publication date
KR100863204B1 (en) 2008-10-13
EP1680884B1 (en) 2018-12-05
AU2004285255B2 (en) 2008-09-04
WO2005043334A3 (en) 2005-12-22
US8856905B2 (en) 2014-10-07
TW200517971A (en) 2005-06-01
IL174999D0 (en) 2006-08-20
AR050394A1 (en) 2006-10-25
US20120030742A1 (en) 2012-02-02
US20130227667A1 (en) 2013-08-29
EP1680884A4 (en) 2010-07-28
JP4616268B2 (en) 2011-01-19
AU2004285255A1 (en) 2005-05-12
CN1875564A (en) 2006-12-06
EP1680884A2 (en) 2006-07-19
US20050097330A1 (en) 2005-05-05
AU2004285255C1 (en) 2009-02-19
CA2543987A1 (en) 2005-05-12
NZ546717A (en) 2008-06-30
RU2322763C2 (en) 2008-04-20
US8424068B2 (en) 2013-04-16
WO2005043334A2 (en) 2005-05-12
PE08542005A1 (en) 2005-10-18
BRPI0415916A (en) 2006-12-26
JP2007510235A (en) 2007-04-19
RU2006118331A (en) 2008-01-10
KR20060107798A (en) 2006-10-16
CN1875564B (en) 2018-01-09
MXPA06004676A (en) 2006-12-14

Similar Documents

Publication Publication Date Title
US7380280B2 (en) Rights locker for digital content access control
US9544297B2 (en) Method for secured data processing
EP1427160B1 (en) Methods and systems for authentication of a user for sub-locations of a network location
US7076797B2 (en) Granular authorization for network user sessions
CN101421968B (en) Authentication system for networked computer applications
EP2109955B1 (en) Provisioning of digital identity representations
JP3605501B2 (en) Communication system, a message processing method and a computer system
JP5680548B2 (en) Apparatus and method for granting access to the device
US7051204B2 (en) Methods and system for providing a public key fingerprint list in a PK system
US7181016B2 (en) Deriving a symmetric key from an asymmetric key for file encryption or decryption
EP1770586B1 (en) Account management in a system and method for providing code signing services
CN103535090B (en) System and method for identity management of mobile devices
EP2224368B1 (en) An electronic data vault providing biometrically protected electronic signatures
CN100534092C (en) Method and system for stepping up to certificate-based authentication without breaking an existing ssl session
US20150248287A1 (en) System and methods for remote maintenance in an electronic network with multiple clients
US20060015728A1 (en) Establishment of security context
US7509497B2 (en) System and method for providing security to an application
US20030079143A1 (en) One pass security
CN1820481B (en) System and method for authenticating clients in a client-server environment
US7904952B2 (en) System and method for access control
US7003668B2 (en) Secure authentication of users via intermediate parties
US7877793B2 (en) Repositing for digital content access control
CN100447798C (en) Method and system for using a portable computing device as a smart key device
EP1504561B1 (en) Methods and systems for secure transmission of information using a mobile device
EP1413083B1 (en) System and method for managing network service access and enrollment

Legal Events

Date Code Title Description
AS Assignment

Owner name: QUALCOMM INCORPORATED, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:LUNDBLADE, LAURENCE;REEL/FRAME:014470/0376

Effective date: 20040224

FPAY Fee payment

Year of fee payment: 4

MAFP

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8